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Abstract 

Significant  research  has  been  done  on  bent  functions,  yet 
researchers  in  switching  theory  have  paid  little  attention 
to  this  important  topic.  The  goal  of  this  paper  to  provide 
a  concise  exposition.  Bent  functions  are  the  most  nonlin¬ 
ear  functions  among  n-variable  switching  functions,  and 
are  useful  in  cryptographic  applications.  This  paper  dis¬ 
cusses  three  other  kinds  of  cyptographic  properties,  strict 
avalanche  criterion,  propation  criterion,  and  correlation 
immunity.  We  discuss  known  properties,  as  well  as  open 
questions.  It  assumes  the  reader  is  familiar  with  switching 
circuit  theory.  Familiarity  with  Reed-Muller  expansions  is 
helpful,  but  not  essential. 

1  Introduction 

One  approach  to  encoding  a  plaintext  message  into 
cyphertext  is  to  use  one  7  bit  key  for  each  7  bit  ASCII  char¬ 
acter  and  to  apply  the  bitwise  exclusive  OR  to  each  letter. 
In  this  way,  each  letter  of  the  plaintext  message  is  converted 
to  a  different  letter  in  the  cyphertext.  Decryption  is  sim¬ 
ple.  Just  apply  the  same  key  to  the  cyphertext.  Since  the 
second  application  of  the  key  “annihilates”  the  first  appli¬ 
cation,  we  are  left  with  the  plaintext  letter.  The  problem 
with  this  is  that  the  distribution  of  probabilities  of  the  let¬ 
ters  in  the  plaintext  also  occurs  in  the  cyphertext.  This  can 
be  exploited  by  someone  listening  to  the  cyphertext.  For 
example,  the  most  frequent  letters  in  the  cyphertext  may  be 
assumed  to  be  “e”  or  “t”  and  the  least  frequent  letters  may 
be  assumed  to  be  “z”  or  “q”. 

To  avoid  decryption  by  an  outsider,  one  seeks  a  key 
stream  that  is  random.  However,  high-speed  highly  parallel 
computers  can  be  used  to  exploit  variations  from  random¬ 
ness  in  the  key  stream.  For  example,  in  a  “linear”  attack,  a 
key  stream  is  tried  that  is  generated  from  a  linear  Boolean 
function.  If  the  actual  key  stream  used  in  encryption  is  close 


to  linear,  there  will  be  errors,  but  such  an  attack  may  be  ul¬ 
timately  successful.  Against  such  attacks,  one  seeks  a  func¬ 
tion  that  is  as  far  from  linear  as  possible.  These  are  the  bent 
functions. 

In  the  next  section,  we  introduce  bent  functions  and  dis¬ 
cuss  their  properties.  In  the  third  section,  we  discuss  sym¬ 
metric  bent  functions.  Then,  in  the  next  three  sections, 
we  discuss  three  classes  of  functions  that  have  other  cryp¬ 
tographic  properties.  These  are  the  strict  avalanche  crite¬ 
rion,  the  propagation  criterion,  and  the  correlation  immu¬ 
nity.  Then,  we  provide  concluding  remarks. 

2  Properties  of  Bent  Functions 

The  term  bent  function  describes  functions  that  are  the 
“most  nonlinear”  of  the  n-variable  functions.  It  was  intro¬ 
duced  in  1976  by  Rothaus  [16].  Presumably,  “bent”  was 
chosen  since  it  is  an  antonym  of  “linear”.  Rothaus’  semi¬ 
nal  work  [16]  was  actually  completed  ten  years  earlier,  but 
remained  under  restricted  circulation  until  1976.  Rothaus 
died  in  2003,  six  days  before  he  was  scheduled  to  retire 
from  the  Department  Mathematics  at  Cornell  University. 
Recently,  his  work  was  chosen  for  inclusion  in  Knuth’s 
long-anticipated  “The  Art  of  Computer  Programming,  Vol¬ 
ume  4”  [9]. 

Definition  2.1  A  linear  function  is  the  constant  0  function 
or  the  Exclusive  OR  of  one  or  more  variables. 

Example  2.1  There  are  eight  3-variable  linear  functions, 
0,  x\,  X2,  X3,  X\  ®  X2,  x\  ®  X3,  X2  ffi  X3,  and  x\  ®  X2  ffi  X3. 
Only  one  of  the  eight  functions  actually  depends  on  all  three 
variables.  However,  because  it  simplifies  the  counting  of 
functions,  we  will  view  all  eight  functions  as  functions  of  3 
variables.  (End  of  Example) 
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Definition  2.2  An  affine  function  is  a  linear  function  or 
the  complement  of  a  linear  function* . 

Example  2.2  There  are  16  different  3-variable  affine  func¬ 
tions,  0,  X\,  X2,  X3,  X\®X2,  £182:3,  £282:3,  £i8£2  8£3,  1, 

£i8l,  £281,  £381,  £1  8  £281,  £1  8  £381,  £2  8  £381, 

£1  8  £2  8  £3  8  1.  (End  of  Example) 

Affine  functions  are  one  extreme  type  of  switching  function. 
We  are  interested  in  the  extent  to  which  a  switching  function 
departs  from  affine  functions. 

Definition  2.3  The  nonlinearity  NLf  of  a  function  f 
is  the  minimum  number  of  truth  table  entries  that  must  be 
changed  in  order  to  convert  f  to  an  affine  function. 

The  nonlinearity  of  a  function  /  is  the  minimum  Ham¬ 
ming  distance  between  the  truth  tables  of  /  and  an  affine 
function^. 

Example  2.3  Among  3-variable  functions,  the  function 
f  =  x±x2x3,  which  is  not  affine,  has  nonlinearity  1,  since 
converting  the  single  1  in  its  truth  table  to  a  0  creates  the 
constant  0  function,  which  is  affine.  (End  of  Example) 

Definition  2.4  Let  f  be  a  Boolean  function  on  n-variables, 
where  n  is  even,  f  is  a  bent  function  if  its  nonlinearity 
is  as  large  as  possible  (namely  2n~1  —  2t~1)  t. 

Bent  functions  have  the  property  that  they  are  a  max¬ 
imum  distance  from  all  affine  functions.  For  example, 
/  =  £i£’2  8  £3£4  is  a  known  bent  function  on  4  variables;  it 
is  a  distance  6  from  16  of  the  32  affine  functions  on  4  vari¬ 
ables  and  a  distance  10  from  the  other  16  affine  functions. 
That  is,  at  least  six  entries  of  the  truth  table  of  /  must  be 
changed  to  convert  it  into  an  affine  function.  Further,  there 
are  16  affine  functions  that  can  be  achieved  by  changing  six 
entries  in  the  truth  table  of  /.  Since  there  are  no  4-variable 
functions  whose  minimal  distance  to  an  affine  function  is  7 
or  larger,  it  follows  that  /  =  £i£2  8  £3£4  is  bent. 

Bent  functions  are  important  because  of  a  cryptanaly¬ 
sis  technique  in  which  nonlinear  functions  used  in  the  en¬ 
cryption  process  are  approximated  by  linear  functions.  That 

*In  papers  on  switching  theory,  the  term  "linear”  is  often  used  to  de¬ 
scribe  an  affine  function. 

'We  note  an  inconsistency  in  the  terminology.  The  term  “nonaffinity” 
would  be  a  more  consistent  alternative  to  "nonlinearity”.  However,  we 
have  not  observed  any  author  who  has  used  "nonaffinity”. 

iRothaus  [16]  originally  defined  bent  functions  to  be  switching  func¬ 
tions  whose  Walsh  transform  contains  only  the  values  ±2n/''2.  which  is  an 
integer  only  when  n  is  even.  He  later  showed  that  bent  functions  achieved 
the  largest  nonlinearity,  and  bent  functions  are  often  defined  in  terms  of 
this  characteristic.  No  switching  function  with  odd  n  satifies  Rothaus' 
definition.  The  term  “semi-bent”  is  often  applied  to  switching  functions 
whose  Walsh  transform  contains  only  the  values  (0,  2z2<n  1  1  “  " }.  when 
n  is  odd.  For  example,  the  majority  function  on  3-variables,  with  a  reduced 
truth  table  of  (0,  0, 1, 1).  has  a  Walsh  transform  of  (0,  4, 4,  0,  4,  0,  0,  —4). 
It  is  a  semi-bent  function. 


is,  when  the  encryption  is  linear,  decryption  is  straightfor¬ 
ward.  When  the  encryption  is  “slightly  nonlinear”,  then  a 
linear  approximation  can  be  used,  with  an  understanding 
that  decryption  is  erroneous  but  potentially  correctable.  In¬ 
deed,  Matsui  [12,  13]  proposes  a  linear  attack  of  the  Data 
Encryption  Standard  (DES).  Bent  functions  are  valued  be¬ 
cause  they  are  the  most  difficult  to  approximate  by  linear 
functions. 

Table  1  shows  all  2-variable  functions  and  their  nonlin¬ 
earity  values.  The  leftmost  column  shows  the  four  assign¬ 
ments  of  values  to  two  variables,  and  the  next  16  columns 
show  the  truth  tables  of  the  16  different  2-variable  func¬ 
tions.  The  last  row  shows  the  nonlinearity  NL  value.  There 
are  2  x  22  =  8  functions  that  are  affine,  and  have  a  nonlin¬ 
earity  value  of  0.  For  all  of  the  remaining  functions,  only 
one  change  in  a  truth  table  value  creates  an  affine  function. 
For  example,  /14  =  £i£2  8  1  has  three  l’s,  and  changing 
any  one  of  them  to  0  creates  an  affine  function.  Therefore, 
for  2-variables,  there  exist  eight  bent  functions. 

Fig.  1  shows  the  distribution  of  nonlinearity  values  for  all 
65,536  functions  on  4-variables.  For  example.  Fig.  1  shows 
that  32,  512,  3840,  and  17920  4- variable  functions  have 
a  nonlinearity  of  0,  1,  2,  and  3,  respectively.  We  expect 
32  functions  to  have  a  nonlinearity  of  0  because  that  is  the 
number  of  affine  4-variable  functions.  The  number  of  func¬ 
tions  with  nonlinearity  1  is  512.  As  it  turns  out,  512  is  an 
upper  bound  on  the  number  of  functions  with  that  nonlinear¬ 
ity.  That  is,  for  each  4-variable  function  with  nonlinearity  0, 
there  can  be  no  more  than  16  functions  that  are  a  Hamming 
distance  1  from  it,  for  a  total  of  32  x  16  =  512  functions.  It 
must  be  that,  among  the  functions  with  nonlinearity  1,  none 
are  a  Hamming  distance  1  away  from  two  or  more  affine 
functions. 

A  similar  statement  is  true  of  4-variable  functions  with 
nonlinearity  2  and  3.  If  all  such  functions  are  unique,  then 
there  are  (26)32  =  3,840  and  (g6)32  =  17,920  functions 
respectively.  As  can  be  seen  from  Fig.  1,  there  are  3,840  and 
17,920  functions  with  nonlinearity  2  and  3,  respectively. 

It  follows  that  all  functions  with  nonlinearities  0,  1,  2, 
and  3  are  a  minimum  distance  from  exactly  one  affine  func¬ 
tion.  For  functions  with  nonlinearity  4  or  more,  the  same 
statement  is  not  true;  for  such  functions  there  is  more  than 
one  affine  function  for  which  the  minimum  distance  exists. 

Fig.  1  shows  that  most  4- variable  functions  have  a  non¬ 
linearity  value  near  the  middle,  around  3,  4,  and  5.  By  com¬ 
parison,  functions  with  extreme  nonlinearity  values,  0  and 
6,  are  rare.  Indeed,  the  fraction  of  all  ^-variable  affine  func¬ 
tions  approaches  0  as  n  increases.  Specifically,  the  fraction 
of  functions  that  are  affine,  2”+1/22  ,  rapidly  approaches  0 
as  n  — >  00.  The  extreme  values  are  important.  The  32  func¬ 
tions  with  nonlinearity  0  are  the  affine  functions.  There  are 
896  functions  with  nonlinearity  6;  these  are  the  bent  func¬ 
tions.  The  exact  number  of  bent  functions  is  known  only 


Table  1.  All  2-variable  functions  and  their  nonlinearity,  NL. 
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Figure  1.  Distribution  of  All  4-Variables  to 
Nonlinearity 


for  small  values  of  n.  That  is,  an  exact  number  of  bent 
functions  is  known  only  for  n  <  8  [1,  10,  14].  The  num¬ 
ber  of  n-variable  bent  functions,  for  general  n,  is  an  open 
question  that  has  resulted  in  a  number  of  studies  on  bounds 
[1,  16].  Table  2  shows  the  number  of  bent  functions  for 
2  <  n  <  8.  Note  that,  while  the  number  of  bent  functions 
increases  rapidly  with  increasing  n,  the  proportion  of  func¬ 
tions  that  are  bent  decreases  rapidly. 

Table  2.  The  number  of  n-variable  bent  func¬ 
tions  for  2  <  n  <  8. 
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Definition  2.5  The  weight  |/|  of  a  function  f  is  the  num¬ 
ber  of  1  ’s  in  the  truth  table  of  f. 

Fig.  2  shows  the  distribution  of  4-variable  functions  to 
the  weight  of  the  function  and  its  nonlinearity.  Specifically, 
a  function  contributes  1  to  the  count  of  functions  that  have 
a  specified  weight  and  a  specified  nonlinearity,  NLf.  The 
vertical  axis  shows  the  log  of  the  number  of  functions  (to 
allow  the  display  of  both  small  and  large  values).  There  are 
seven  graphs,  one  for  each  value  of  NLf  =  0,  1,  2,  3,  4,  5, 
and  6.  For  example,  the  top  graph  shows  the  distribution  of 
affine  functions  with  respect  to  weight.  In  this  case,  there 
is  one  function  with  weight  0  (the  constant  0  function),  30 
functions  with  weight  8,  and  one  function  with  weight  16 
(the  constant  1  function).  Interestingly,  the  distribution  of 
896  bent  functions,  as  shown  in  the  last  graph,  is  simple. 
Specifically,  448  have  weight  6  and  448  have  weight  10.  In 
general. 

Theorem  2.1  The  weight  of  an  n-variable  bent  function  is 

2n~1  ±27-\ 

Note  that  the  bar  chart  in  Fig.  2  is  symmetric  with  respect 
to  the  center  line  of  weight  8.  This  is  because  /  and  its 
complement  /  =  /  ®  1  are  both  bent. 

We  observed  in  Fig.  1  that  all  functions  with  nonlinearity 
1  were  a  Hamming  distance  1  from  a  unique  function  with 
nonlinearity  0.  This  can  be  seen  in  Fig.  2.  For  example, 
for  the  trivial  affine  function  whose  truth  table  is  all  0’s, 
there  are  16  functions  with  NLf  =  1  that  with  weight  1. 
Similarly,  for  the  trivial  affine  function  whose  truth  table 
is  all  l’s,  there  are  16  functions  with  NLf  =  1  that  have 
weight  15.  For  each  of  the  30  affine  functions  with  weight 
8,  there  are  16  functions  that  are  a  distance  1  away.  This  is 
shown  by  two  bars  each  of  height  30  x  16/2  =  240,  one 
with  weight  7  and  the  other  with  weight  9. 

Definition  2.6  Switching  function  f  is  NPN  equivalent 
to  h  iff  f  can  be  obtained  from  h  by  a  complementation  of 
variables  (N),  a  permutation  of  variables  (P),  and  a  com¬ 
plementation  of  the  function  (N). 

The  following  four  results  from  Cusick  and  Stanica  [2] 
relate  bent  functions  to  the  NPN  equivalence  classes. 


Function’s  Weight 


Figure  2.  Distribution  Over  4-Variable  Func¬ 
tions  to  Nonlinearity  and  to  the  Weight.  (The 
log  of  the  number  of  functions  is  plotted 
along  the  vertical  axis). 


Lemma  2.1  /  is  a  bent  function  iffl  ©  /  is  a  bent  function. 

Lemma  2.2  f(x  i,  X2 , ,Xi, ,  xn)  is  a  bent  function  iff 
f(x  i,  X2, . . . ,  Xi, . . . ,  xn)  is  a  bent  function. 

Lemma  2.3  f(xi,X2,---,Xi,...,Xj,...,xn)  is  a  bent 
function  iff  f(x  i,X2, . . .  ,Xj, . . .  ,Xi, . . . ,  xn)  is  a  bent 
function. 

From  Lemmas  2.1,  2.2,  and  2.3,  we  have 

Theorem  2.2  /  is  a  bent  function  iff  any  function  in  the 
same  NPN  equivalence  class  as  f  is  a  bent  function. 

Theorem  2.2  states  that  either  all  functions  in  an  NPN 
equivalence  class  are  bent  or  all  are  not  bent.  It  follows 
that  one  way  to  enumerate  bent  functions  is  to  enumerate 
all  bent  NPN  equivalence  classes. 

Another  equivalence  class  exists. 

Definition  2.7  Switching  function  f  is  A  equivalent  to 
h  iff  h  =  f  ©  g,  where  g  is  an  affine  function,  f  and  h  are 
said  to  belong  to  the  same  A-class. 

Lemma  2.4  /  is  a  bent  function  iff  f  ®  gaffine  is  a  bent 
function,  where  gaffine  is  an  affine  function. 

Lemma  2.4  states  that  functions  in  the  same  A-class  are 
either  all  bent  or  all  not  bent. 

Example  2.4  From  Fig.  2,  there  are  896  bent  functions  on 
four  variables.  These  are  divided  into  equivalence  classes 
with  respect  to  the  affine  functions.  Since  there  are  32  affine 


functions,  there  are  896/32  =  28  equivalence  classes.  Note 
that,  unlike  NPN  equivalence  classes,  these  equivalence 
classes  have  the  same  number  of  elements,  2n+1,  as  the 
number  of  affine  functions.  (End  of  Example) 

Note  that  Lemma  2.4  can  be  used  to  prove  Lemma  2.1. 
That  is,  if  /  is  a  bent  function,  from  Lemma  2.4,  then  so  is 
/  ©  1  =  /.  This  proves  Lemma  2.1. 

Definition  2.8  The  PPRM  (positive  polarity  Reed 
—Muller  form)  of  a  function  f  is 

f  =  a0  ®  0,1X1  ©  a2x 2  ©  ...  ©  anxn  ©  ai^XiX2 
©aij3a;ia;3  ©  ...  ©  an_ i,nxn-ixn  ©  . . . 

©ai,2,...,a„£l£2  •  •  -xn. 

The  PPRM  of  a  function  f  is  also  called  the 
algebraic  normal  form  (ANFJ  of  f  (e.g.  [2]). 

Definition  2.9  The  degree  of  a  product  term  in  a 
PPRM  is  the  number  of  variables  in  that  term.  The 
degree  of  a  function  f  is  the  number  of  variables  in  a 
term  with  maximum  degree  in  its  PPRM. 

Lemma  2.4  implies  that,  given  the  PPRM  of  any  bent  func¬ 
tion  /,  another  bent  function  is  realized  by  simply  changing 
the  coefficients  of  the  constant  or  linear  terms  in  the  PPRM 
of  /.  One  can  take  as  the  representative  of  the  A-class  of  a 
bent  function,  the  function  whose  constant  and  linear  terms 
are  all  absent. 

In  the  case  of  all  4-variable  bent  functions,  it  is  known 
that  the  highest  degree  is  2.  That  is,  in  4-variable  bent  func¬ 
tions  there  are  no  terms  in  the  PPRM  with  degree  3  or  4. 
Further,  at  least  one  term  of  degree  2  is  needed;  otherwise, 
the  function  is  affine.  However,  if  a  function  is  bent,  per¬ 
muting  variables  yields  a  bent  function.  It  follows,  for  ex¬ 
ample,  that,  if  a  bent  function  has  two  quadratic  terms,  say 
X\X2  ©  X3X4,  then  there  is  a  bent  function  with  quadratic 
terms  X4X3QX2X4  and  another  bent  function  with  quadratic 
terms  £1X4  ©  £2  £3. 

Fig.  3  shows  the  ways  pairs  of  variables  can  be  arranged 
in  4-variable  functions.  There  are  11  ways  pairs  can  occur, 
including  the  case  where  there  are  no  pairs  (shown  at  the 
very  top).  For  each  of  these  ways,  there  is  a  graph  in  Fig.  3. 

In  all,  there  are  26  =  64  ways  possible  choices  for  A- 
classes  for  4-variable  bent  functions.  However,  from  a  pre¬ 
vious  discussion,  we  know  that  there  are  actually  only  28 
A-classes.  The  circles  in  Fig.  3  show  the  sets  of  pairs  that 
actually  occur  in  4-variable  bent  functions.  There  are  four 
sets  involving  2,  3,  4,  and  6  pairs  of  variables.  One  of  the 
sets  in  Fig.  3  has  exactly  two  pairs  of  variables  such  that  no 
variable  appears  in  more  than  one  pair  (i.e.  the  pairs  are  dis¬ 
joint).  The“3”  shown  adjacent  to  the  arrangement  labeled 
“Disjoint  quadratic  functions”  means  that  there  are  three 
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Figure  3.  All  arrangements  of  pairs  of  vari¬ 
ables  in  4-variable  functions  (Bent  functions 
are  circled). 


functions.  These  are  f  —  2424  ©  £324,  /  =  a.’ia;3  ©  £224, 
and  /  =  2424  ©  X2X3.  This  function  has  special  signifi¬ 
cance. 

Definition  2.10  The  disjoint  quadratic  function  [23] 
is 

/  =  2424  ©  2:324  ©...©  X„-iXn,  (1) 

where  n  is  an  even  positive  integer. 

This  is  similar  to  the  Achilles’  heel  function,  which  has 
been  defined  using  V  instead  of  ©  [18,  19].  It  has  often  been 
offered  as  an  example  of  how  important  variable  order  is  in 
the  realization  of  a  function  by  a  binary  decision  diagram 
(BDD).  The  disjoint  quadratic  function  was  among  the  first 
forms  known  to  be  bent  [16].  It  is  interesting  that  all  bent 
functions  on  4  variables  are  either  symmetric,  (consisting  of 
the  exclusive  OR  of  all  pairs)  or  symmetric  with  two,  three, 
or  four  pairs  removed.  Specifically,  let  g  be  the  set  of  sym¬ 
metric  bent  functions.  Then,  the  set  of  all  4-variable  bent 
functions  consists  of 

1-  g, 

2.  g  ©  XiXj  ©  XjXk, 

3.  g  ©  x^j  ©  XjXk  ©  2424,  or 

4.  g  ©  x^j  ©  XjXk  ©  XkXi  ©  2424, 

as  well  as  functions  derived  from  these  by  exclusive  ORing 
affine  functions.  Here,  ©  serves  to  remove  a  term. 


The  observation  that  4-variable  bent  functions  have  de¬ 
gree  at  most  2  can  be  extended.  From  Rothaus  [16],  the 
following  surprising  result  is  known. 

Theorem  2.3  For  n  >  2,  an  n-variable  bent  function  has 
degree  at  most 

For  n  =  2,  the  degree  of  a  bent  function  is  2.  This  represents 
a  strong  confinement  on  where  a  search  for  bent  functions 
may  be  restricted.  Rothaus  [16]  further  showed  that  there 
exist  bent  functions  on  every  degree  d.  where  2  <  d  < 
There  is  significant  interest  in  homogeneous  bent  functions 
[15,22,25], 

Definition  2.11  A  homogeneous  function  is  a  function 
whose  PPRM  consists  of  product  terms  all  with  the  same 
degree. 

Example  2.5  The  disjoint  quadratic  function,  f  =  X124  © 
X3X4  ©  ...  ©  xn-iXn,  is  homogeneous.  (End  of  Example) 

Xia,  Seberry,  Pieprzyk,  and  Charnes  [25]  showed  the  fol¬ 
lowing. 

Theorem  2.4  When  n  >  6,  no  n-variable  homogeneous 
bent  function  has  degree  ”. 

Therefore,  from  [16]  and  [25],  for  n  >  6,  degree-^  71- 
variable  bent  functions  exist,  but  none  are  homogeneous. 
The  4-variable  disjoint  quadratic  function  is  an  example  of 
a  4-variable  homogeneous  bent  function  (of  degree  2).  Xia, 
Seberry,  and  Pieprzyk  [15]  show  the  existence  of  homoge¬ 
neous  6-variable  bent  functions  of  degree  3.  Thus,  Theorem 
2.4  does  not  hold  for  n  <  6. 

3  Properties  of  Symmetric  Bent  Functions 


Definition  3.12  A  symmetric  function  is  unchanged  by 
any  permutation  of  its  variables. 

Regarding  symmetric  functions,  in  1994,  Savicky  [20] 
showed  the  following. 

Lemma  3.5  There  are  exactly  four  n-variable  symmetric 
bent  functions  on  n  >  2  variables.  All  have  degree  2. 

Next,  we  consider  a  symmetric  function,  S(n,  to),  that  was 
used  to  analyze  the  complexity  of  adders. 

Definition  3.13  [17],  p.  310 

S(n,m)  =  >ffi  24. 24, . . .  24  . 


(2) 


Nonlinearity  -  Minimum  Distance  From  Affine  Functions 


Figure  4.  Distribution  of  4- Variable  Symmetric 
Functions  by  Nonlinearity 


Example  3.6  For  n  =  4,  we  have 
5(4,4)  =  X1X2X3X4, 

5(4, 3)  =  X1X2X3  ®  X1X2X4  ®  X1X3X4  ®  X2X3X4, 

5(4, 2)  =  X1X2  ®  X1X3  ®  X1X4  ®  X2X3  ®  X2X4  ffi  £30:4, 
5(4, 1)  =  Xi  ®  x2  ®  x3  ®  X4, 

5(4,0)  =  1 

A  4-variable  symmetric  bent  functions  has  the  form 

f=  5(4,2)  ®Cl5(4,l)®c05(4,0), 

where  Co,  ci  £  {0,1}.  Since  there  are  four  ways  to  choose 
Ci  and  Co,  there  are  four  symmetric  functions  on  4  variables. 

(End  of  Example) 

However,  this  suggests  a  general  result.  That  is,  Savicky’s 
[20]  result  can  be  stated  more  precisely,  as  follows. 

Lemma  3.6  There  are  exactly  four  n-variable  symmetric 
bent  functions  on  n  >  2  variables,  as  follows. 

f  =  S(n,  2)  ®  ci5(n,  1)  ®  c0S(n,  0),  (3) 

where  co,ci  £  {0,1}.  Fig.  4  shows  the  distribution  of 
4-variable  symmetric  functions  according  to  nonlinearity. 
There  is  symmetry  about  nonlinearity  3.  For  example,  four 
symmetric  functions  have  nonlinearity  0  (0,l,Xi®X2®a;3® 
X4,  and  Xi  ffi  X2  ®  x3  ®  X4  ®  1  and  4  have  nonlinearity  6 
(and  are  bent). 

4  The  Strict  Avalanche  Criterion 

Webster  and  Tavares  [24]  introduced  the  following  con¬ 
cept. 


Definition  4.14  A  function  f  satisfies  the 
strict  avalanche  criterion  (SAC)  iff  complement¬ 
ing  any  single  variable  complements  exactly  half  of  the 
function  values. 

Definition  4.15  The  Boolean  difference  of  a  function  f 
with  respect  to  variable  Xi  is  =  f(\xt  =  0)  ffi  /( \xi  = 
1). 

Definition  4.16  An  n-variable  function  f  is  balanced  iff 
its  weight  is  2n~1. 

That  is,  a  function  is  balanced  iff  its  function  value  has  the 
same  number  of  l’s  as  0’s. 

Lemma  4.7  An  n-variable  function  /  satisfies  SAC  iff 
\£-\  =  2"-1  for  all  Xi. 

That  is,  an  n-variable  function  /  satisfies  SAC  iff  -Iff-  is 
balanced  for  all  x^. 

Example  4.7  Consider  the  4-variable  disjoint  quadratic 
function  f  =  X1X2  ffi  X3X4.  We  have 

df  df  df  ,  df 

- —  =  x2,  - —  =  xi,  —  =  X4,  and—  =  x3.  (4) 

ax  i  ax  2  ax  3  ax 4 

Since  each  Boolean  difference  is  simply  Xi,  each  is  bal¬ 
anced,  and  the  4-variable  disjoint  quadratic  function  sat¬ 
isfies  SAC.  It  is  known  that  every  bent  function  satisfies  SAC 
[5],  (End  of  Example) 

For  some  functions,  complementing  one  variable 
changes  a  few  output  values.  For  example,  for  the  AND 
function,  complementing  one  variable,  say  x\,  changes  just 
two  output  values,  those  for  X1X2  ■  ■  ■  xn  =  01 ...  1  and 
11 ...  1  or  0f  the  output  values.  For  other  func¬ 

tions,  complementing  x±  changes  many  output  values;  for 
Xi  +  ,x'2.x'3  . . .  xn,  for  example,  complementing  X\  changes 
all  but  two  output  values  or  1  —  2„1_1  of  the  output  values. 
The  criterion  “avalanche”  suggests  a  small  change,  such  as 
complementing  one  variable,  yields  a  much  larger  change 
in  the  output.  However,  when  this  is  applied  to  a  crypto¬ 
graphic  application,  the  need  to  achieve  maximum  confu¬ 
sion  suggests  that  there  should  be  a  balance  between  what  is 
changed  and  what  is  not  (i.e.  one-half  of  the  output  values 
are  changed).  This  corresponds  to  the  descriptor  “strict”. 
This  descriptor  is  accurate  for  another  reason;  the  number  of 
functions  that  satisfy  the  strict  avalanche  criterion  is  small. 
Forre[4]  introduced  the  following  idea. 

Definition  4.17  An  n-variable  function  f  satisfies 
SAC(k)  iff,  for  any  assignment  of  values  to  any  k  of  the 
n  variables,  the  resulting  function  satisfies  SAC. 

Note  that  5AC(0)  is  the  same  as  SAC. 


Figure  5.  Distribution  of  All  2-,  3-,  and  4- 
Variable  Functions  to  SAC(k) 


Example  4.8  The  4-variable  disjoint  quadratic  function 
f  =  X1X2  ®  X3X4  satisfies  S' 2167(0),  as  shown  in  Example 
4.7,  but  not  SAC {1).  For  example,  if  X\  =  0,  then  comple¬ 
menting  X2  yields  no  change  in  the  function  values,  while 
if  x  1  =  1,  then  complementing  X2  changes  eight  function 
values.  (End  of  Example) 

Figure  5  shows  a  histogram  of  the  number  of  functions 
according  to  the  k  for  which  a  function  satisfies  SAC(k), 
for  n-variable  functions,  where  2  <  n  <  4.  The  functions 
that  satisfy  SAC  (=  SAC(O))  are  so  labeled.  A  function 
is  counted  towards  the  largest  k  for  which  it  is  SAC(k). 
For  example,  although  sixty-four  3-variable  functions  sat¬ 
isfy  SAC(O),  only  48  are  shown  because  16  also  satisfy 
SAC(k)  for  k  >  0.  Note  that  the  majority  of  functions  do 
not  satisfy  SAC(k)  for  any  k  >  0. 

5  The  Propagation  Criterion 

A  concept  closely  related  to  the  strong  avalanche  crite¬ 
rion  is  the  propagation  criterion. 

Definition  5.18  An  n-variable  function  f  satisfies  the 
propagation  criterion  (PC(k))  iff  complementing  any 
k  or  fewer  of  the  n  variables  complements  exactly  half  of  the 
function  values. 

Note  that  a  function  satisfies  PC(  1)  iff  it  satisfies  SAC(O). 
Indeed,  the  propagation  criterion  is  a  generalization  of 
SAC(O),  just  as  SAC(k)  is  a  generalization  of  SAC(O). 
Fig.  6  shows  the  distribution  of  functions  to  the  propagation 
criterion  for  up  to  n  =  4  variables.  In  this  figure,  a  function 


Figure  6.  Distribution  of  All  2-, 3-,  and  4- 
Variables  to  the  Propagation  Criterion 


contributes  to  only  one  k,  the  maximum  k  for  which  it  satis¬ 
fies  PC(k).  For  example,  although  64  3-variable  functions 
satisfy  PC(  1),  0  are  shown  because  all  satisfy  PC(k)  for 
k  >  1.  It  can  be  seen  that  for  n  =  2  and  n  =  4,  all  functions 
that  satisfy  PC(  1)  also  satisfies  PC(k)  for  k  >  1. 

6  Correlation  Immunity 

Another  characteristic  of  Boolean  functions  that  is  im¬ 
portant  in  cryptographic  applications  is  correlation  immu¬ 
nity.  This  describes  the  extent  to  which  the  variable  values 
can  be  guessed  given  the  function  value.  An  example  of 
a  function  that  has  low  correlation  immunity  is  the  AND 
function  on  n  >  1  variables.  For  example,  if  this  func¬ 
tion’s  output  value  is  1,  then  the  input  variable  values  are 
X1X2  ■  ■  ■  xn  =  11 ...  1  with  probability  100%.  Because 
of  this,  the  AND  function  is  not  a  good  choice  for  cryp¬ 
tographic  applications. 

Interest  in  correlation  immunity  developed  because 
Siegenthaler  [21]  in  1984  showed  how  an  attack  can  be  ef¬ 
fectively  applied  to  encryption  systems  using  functions  with 
low  correlation  immunity. 

Definition  6.19  An  n-variable  function  f  has 
correlation  immunity  k  iff,  for  every  fixed  set  S 
of  k  variables,  1  <  k  <  n,  given  the  value  of  f,  the 
probability  that  S  takes  on  any  of  its  2k  assignments  of 
values  to  the  k  variables  is  If  an  n-variable  function 
has  correlation  immunity  k  and  is  balanced,  then  it  has 
resiliency  of  order  k. 

We  expect  that  the  more  variable  values  we  know,  the 
greater  the  chance  we  know  the  function  value.  If  we  know 


all  values,  then  we  certainly  know  the  function  value,  since 
we  can  examine  its  truth  table.  However,  we  might  ask,  if 
we  know  n—  1  of  the  variable  values,  do  we  know  the  func¬ 
tion  value?  If  the  function  depends  on  a  variable  Xi ,  then 
there  is  an  assignment  of  values  to  the  variables  besides  Xi 
such  that  the  function  changes  if  Xi  changes.  Thus,  the  an¬ 
swer  is  no.  Considering  the  opposite  extreme,  we  might 
ask:  Does  there  exist  a  function  such  that,  for  every  assign¬ 
ment  to  every  set  of  n  —  1  variables,  we  will  not  be  able 
to  determine  the  function’s  value?  If  this  is  true,  then  the 
function  has  correlation  immunity  n  —  1. 

An  alternative  definition  of  the  correlation  immunity  is 
as  follows. 

Definition  6.20  An  n-variable  function  /  has 
correlation  immunity  k  iff,  for  every  fixed  set  S 
of  k  variables,  1  <  k  <  n,  and  for  every  assignment  of 
values  to  the  variables  in  S,  the  weights  of  all  subfunctions 
are  the  same. 

Now  consider  several  examples. 

Definition  6.21  The  barbell  function  fxt  is 

X\X2  ■  ■  ■  xn  ®  X\X2  ■  •  •  xn. 

Definition  6.22  A  threshold  function  fx  is  1  iff  the 

weighted  sum  WiXi  exceeds  or  equals  T,  where  Xi  is 

viewed  as  an  integer  equal  to  its  logic  value  and  Wi  and  T 
are  real  numbers. 

Example  6.9  It  follows  that  the  n-variable  AND  function 
has  correlation  immunity  Ofor  n  >  1.  At  the  other  extreme, 
the  n-variable  Exclusive  OR  function  has  correlation  im¬ 
munity  n  —  1,  for  n  >  2.  This  answers  the  question  posed 
above.  Indeed,  there  are  two  functions  with  correlation  im¬ 
munity  n  —  1,  the  other  being  the  complement  of  the  exclu¬ 
sive  OR  function.  There  only  two  functions  with  correla¬ 
tion  immunity  greater  than  that  of  the  two  parity  functions. 
These  are  the  constant  0  and  1  functions  with  correlation 
immunity  n.  Note  that  a  function  with  an  odd  number  of  l’s 
has  correlation  immunity  0. 

The  barbell  function  X\X2  . . .  xn  ©  X\X2  . . .  xn  has  cor¬ 
relation  immunity  1  for  n  >  1. 

Any  threshold  function  on  n  >  1  variables  has  corre¬ 
lation  immunity  0,  because  the  probability  the  function  is 
1  is  different  depending  on  whether  or  not  the  value  of  a 
variable  moves  the  weighted  sum  closer  to  the  threshold. 

(End  of  Example) 

Lemma  6.8  An  n-variable  function  f  has  correlation  im¬ 
munity  1  iff  f  ©  Xi  is  balanced  for  all  1  <  i  <  n. 

Example  6.10  No  bent  function  f  has  correlation  immu¬ 
nity  1  because  f  ©  Xi  is  also  bent,  and  no  bent  function  is 
balanced.  (End  of  Example) 


Figure  7.  Distribution  of  All  2-,  3-  and  4- 
Variable  Functions  to  Correlation  Immunity 


Fig.  7  shows  the  distribution  of  the  n-variable  func¬ 
tions  to  their  correlation  immunity,  for  2  <  n  <  4.  For 
4-variable  functions,  there  are  only  two  functions  with  the 
maximum  correlation  immunity  4.  These  are  the  constant  0 
and  1  functions.  This  follows  from  the  observation  that  the 
only  way  to  have  correlation  immunity  4  is  for  all  assign¬ 
ments  of  values  to  the  variables  to  be  the  same.  There  are 
only  two  functions  with  the  next  largest  correlation  immu¬ 
nity  3.  These  are  the  parity  functions,  x\  ®x2(Bxs(BX4  and 
1  ©  x\  ©  x2  ©  *3  ©  X4.  There  are  eight  functions  with  cor¬ 
relation  immunity  2.  These  are  x\  ©  x2  ©  £3,  X\  ©  x2  ©  X4, 
X4  ©  X3  ©  X4,  and  x2  ©  x$  ©  X4  and  the  complements  of  each 
of  these  functions.  It  follows  that  the  functions  with  the 
largest  three  correlation  immunity  values  are  affine  func¬ 
tions.  The  other  affine  functions,  those  dependent  on  one  or 
two  variables,  have  correlation  immunity  1. 


Lemma  6.9  If  the  weight  of  an  n-variable  function  f  is  not 
divisible  by  2k,  the  correlation  immunity  of  f  is  at  most 

k-l. 


For  k  =  1,  Lemma  6.9  corresponds  to  the  observation 
above  that  a  function  with  an  odd  number  of  1  ’s  has  correla¬ 
tion  immunity  0.  If  follows  that  at  least  half  of  all  functions 
have  correlation  immunity  0.  For  k  =  n.  Lemma  6.9  states 
that  a  function  in  which  the  number  of  l’s  is  not  divisible  by 
2”  has  correlation  immunity  at  most  n  —  1.  There  are  only 
two  functions  in  which  the  number  of  l’s  is  divisible  by  2ra. 
These  are  /  =  0  and  /  =  1.  As  observed  above,  these  are 
the  only  two  functions  with  correlation  immunity  n. 


7  Concluding  Remarks 

Bent  functions  have  important  cryptographic  properties. 
First,  they  are  very  rare.  As  the  number  of  variables  in¬ 
crease,  they  become  a  vanishingly  small  fraction  of  the  to¬ 
tal  number  of  functions.  Second,  there  is  no  formal  method 
of  constructing  all  bent  functions.  In  the  research  presented 
here,  we  have  used  the  sieve  technique.  In  this  approach,  we 
generate  functions  and  then  test  them  for  bentness.  Indeed, 
we  have  done  this  on  a  reconfigurable  computer  (SRC  Com¬ 
pany’s  SRC -6),  in  which  a  large  FPGA  (a  Xilinx  Virtix-2, 
6000  series)  has  been  configured  to  enumerate  a  prospective 
function,  test  it  against  all  affine  functions  generating  the 
distance  to  each,  choose  the  minimum  distance,  and  tally 
the  generated  function  according  to  its  nonlinearity. 

While  general  bent  functions  are  difficult  to  discover, 
certain  specific  bent  functions  can  be  easily  described.  For 
example,  the  disjoint  quadratic  function  is  bent.  Further, 
there  are  only  four  bent  functions  that  are  totally  symmetric 
and  these  are  easily  described. 

The  number  of  bent  functions  is  an  open  question.  Pre- 
neel  [14]  showed  that  the  number  of  6-variable  bent  func¬ 
tions  is  5,425,430,528  ~  232  3.  For  n  =  8,  a  very  long  com¬ 
putation  [10]  whose  results  were  announced  on  December 
31,  2007  showed  that  the  number  of  A-classes  of  bent  func¬ 
tions  is  approximately  29'  3.  Since  each  A-class  has  2n+1 
functions,  there  are  approximately  2106  3  bent  functions,  as 
shown  in  Table  2. 

Although  there  are  no  bent  functions  on  9  variables,  there 
is  a  surprise  regarding  the  maximum  nonlinearity  for  9- 
variable  functions.  For  odd  n,  one  might  expect  the  upper 
bound  on  nonlinearity  to  be  described  by  the  “bent  concate¬ 
nation  bound”  2n~1  —  2~^~ ,  which  gives  240  for  n  =  9. 
In  2006,  Kavut,  Maitra,  and  Yiicel  [7]  showed  the  existence 
of  a  9-variable  function  with  nonlinearity  241.  This  was  re¬ 
cently  improved  to  nonlinearity  242  in  2008  in  Kavut  and 
Yiicel  [8], 

Maitra  [11]  showed  a  13-variable  function  having  non¬ 
linearity  4034  which  is  2  greater  than  the  bent  concatena¬ 
tion  bound,  building  this  function  from  16  truth  tables  of 
9-variable  bent  functions  having  nonlinearity  242. 

Another  interesting  open  question  is  the  highest  nonlin¬ 
earity  for  n-variable  functions,  where  n  is  odd. 

Still  another  interesting  open  question  is  the  largest  non¬ 
linearity  among  balanced  functions.  This  has  significance 
in  cryptographic  applications  because,  in  practical  systems, 
balance  is  a  dominant  requirement.  That  is,  when  a  bent 
function  is  used,  it  is  modified  to  form  a  balanced  function 
(which  hopefully  still  has  large  nonlinearity).  The  converse 
problem  is  to  find,  among  balanced  functions,  those  with 
maximum  nonlinearity.  This  open  question  was  stated  ex¬ 
plicitly  in  Dobbertin  and  Leander  [3],  Unfortunately,  the 
untimely  death  of  the  first  author  stalled  publication  of  this 


important  paper,  which  is  presently  available  online  only 

[2]. 

An  online  database  exists  that  contains  Boolean  func¬ 
tions  according  to  nonlinearity,  bentness,  degree,  correla¬ 
tion  immunity,  propagation  criterion,  etc.  [26], 
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